| Message ID | 20140410213029.24916.93892.stgit@bhelgaas-glaptop.roam.corp.google.com |
|---|---|
| State | Rejected, archived |
| Delegated to: | David Miller |
| Headers | show |
Bjorn Helgaas > With -Werror=array-bounds, gcc v4.8.x warns that in tcp_sack_remove(), a > selective_acks[] "array subscript is above array bounds". > > I don't understand how gcc figures this out, or why we don't see similar > problems many other places, but this is the only fix I can figure out. ... > diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c > index 65cf90e063d5..65133b108236 100644 > --- a/net/ipv4/tcp_input.c > +++ b/net/ipv4/tcp_input.c > @@ -4047,7 +4047,8 @@ static void tcp_sack_remove(struct tcp_sock *tp) > > /* Zap this SACK, by moving forward any other SACKS. */ > for (i = this_sack+1; i < num_sacks; i++) > - tp->selective_acks[i-1] = tp->selective_acks[i]; > + if (i < ARRAY_SIZE(tp->selective_acks)) > + tp->selective_acks[i-1] = tp->selective_acks[i]; > num_sacks--; > continue; > } You really shouldn't add that test every time around the loop. Try changing the loop so the assignment is: tp->selective_acks[i] = tp->selective_acks[i + 1]; or the loop test to: i <= num_sacks - 1; Or beat up the gcc developers :-) David
On Fri, Apr 11, 2014 at 2:59 AM, David Laight <David.Laight@aculab.com> wrote: > Bjorn Helgaas >> With -Werror=array-bounds, gcc v4.8.x warns that in tcp_sack_remove(), a >> selective_acks[] "array subscript is above array bounds". >> >> I don't understand how gcc figures this out, or why we don't see similar >> problems many other places, but this is the only fix I can figure out. > ... >> diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c >> index 65cf90e063d5..65133b108236 100644 >> --- a/net/ipv4/tcp_input.c >> +++ b/net/ipv4/tcp_input.c >> @@ -4047,7 +4047,8 @@ static void tcp_sack_remove(struct tcp_sock *tp) >> >> /* Zap this SACK, by moving forward any other SACKS. */ >> for (i = this_sack+1; i < num_sacks; i++) >> - tp->selective_acks[i-1] = tp->selective_acks[i]; >> + if (i < ARRAY_SIZE(tp->selective_acks)) >> + tp->selective_acks[i-1] = tp->selective_acks[i]; >> num_sacks--; >> continue; >> } > > You really shouldn't add that test every time around the loop. > > Try changing the loop so the assignment is: > tp->selective_acks[i] = tp->selective_acks[i + 1]; > > or the loop test to: > i <= num_sacks - 1; > > Or beat up the gcc developers :-) You're right, that *is* ugly. And it seems that gcc-v4.9.x doesn't complain about this, and that's good enough for my purposes, so I withdraw this patch. Thanks and sorry for the noise, Bjorn -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 65cf90e063d5..65133b108236 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -4047,7 +4047,8 @@ static void tcp_sack_remove(struct tcp_sock *tp) /* Zap this SACK, by moving forward any other SACKS. */ for (i = this_sack+1; i < num_sacks; i++) - tp->selective_acks[i-1] = tp->selective_acks[i]; + if (i < ARRAY_SIZE(tp->selective_acks)) + tp->selective_acks[i-1] = tp->selective_acks[i]; num_sacks--; continue; }
With -Werror=array-bounds, gcc v4.8.x warns that in tcp_sack_remove(), a selective_acks[] "array subscript is above array bounds". I don't understand how gcc figures this out, or why we don't see similar problems many other places, but this is the only fix I can figure out. Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> --- net/ipv4/tcp_input.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html