On Fri, Apr 11, 2014 at 2:59 AM, David Laight <[email protected]> wrote: > Bjorn Helgaas >> With -Werror=array-bounds, gcc v4.8.x warns that in tcp_sack_remove(), a >> selective_acks[] "array subscript is above array bounds". >> >> I don't understand how gcc figures this out, or why we don't see similar >> problems many other places, but this is the only fix I can figure out. > ... >> diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c >> index 65cf90e063d5..65133b108236 100644 >> --- a/net/ipv4/tcp_input.c >> +++ b/net/ipv4/tcp_input.c >> @@ -4047,7 +4047,8 @@ static void tcp_sack_remove(struct tcp_sock *tp) >> >> /* Zap this SACK, by moving forward any other SACKS. */ >> for (i = this_sack+1; i < num_sacks; i++) >> - tp->selective_acks[i-1] = >> tp->selective_acks[i]; >> + if (i < ARRAY_SIZE(tp->selective_acks)) >> + tp->selective_acks[i-1] = >> tp->selective_acks[i]; >> num_sacks--; >> continue; >> } > > You really shouldn't add that test every time around the loop. > > Try changing the loop so the assignment is: > tp->selective_acks[i] = tp->selective_acks[i + 1]; > > or the loop test to: > i <= num_sacks - 1; > > Or beat up the gcc developers :-)
You're right, that *is* ugly. And it seems that gcc-v4.9.x doesn't complain about this, and that's good enough for my purposes, so I withdraw this patch. Thanks and sorry for the noise, Bjorn -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
