Bjorn Helgaas
> With -Werror=array-bounds, gcc v4.8.x warns that in tcp_sack_remove(), a
> selective_acks[] "array subscript is above array bounds".
>
> I don't understand how gcc figures this out, or why we don't see similar
> problems many other places, but this is the only fix I can figure out.
...
> diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
> index 65cf90e063d5..65133b108236 100644
> --- a/net/ipv4/tcp_input.c
> +++ b/net/ipv4/tcp_input.c
> @@ -4047,7 +4047,8 @@ static void tcp_sack_remove(struct tcp_sock *tp)
>
> /* Zap this SACK, by moving forward any other SACKS. */
> for (i = this_sack+1; i < num_sacks; i++)
> - tp->selective_acks[i-1] = tp->selective_acks[i];
> + if (i < ARRAY_SIZE(tp->selective_acks))
> + tp->selective_acks[i-1] =
> tp->selective_acks[i];
> num_sacks--;
> continue;
> }
You really shouldn't add that test every time around the loop.
Try changing the loop so the assignment is:
tp->selective_acks[i] = tp->selective_acks[i + 1];
or the loop test to:
i <= num_sacks - 1;
Or beat up the gcc developers :-)
David
