2007-01-31 09:22:26

by David Binderman

Subject: fs/ufs/inode.c:817: warning: array subscript is above array bounds

Hello there,

I just tried to compile Linux kernel 2.6.19.2 with the
new GNU C compiler version 4.3 snapshot 20070126.

The compiler said

fs/ufs/inode.c:817: warning: array subscript is above array bounds

The source code is

for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
ufs_inode->ui_u2.ui_addr.ui_db[i] = ufsi->i_u1.i_data[i];

but

./include/linux/ufs_fs.h: __fs32 ui_db[UFS_NDADDR];/*
0x28 data blocks */
./include/linux/ufs_fs.h: __fs64
ui_db[UFS_NDADDR]; /* 112: Direct disk blocks. */

and

__fs32 i_data[15];

and

#define UFS_NDADDR 12
#define UFS_NINDIR 3

so the kernel seems to be trying to write fifteen bytes into an array only
twelve
bytes in size. Suggest code rework.


Regards

David Binderman

_________________________________________________________________
Find Love This New Year With match.com! http://msnuk.match.com

2007-01-31 20:11:05

by Tomasz Kvarsin

Subject: Re: fs/ufs/inode.c:817: warning: array subscript is above array bounds

d binderman wrote:
>Hello there,
>
>I just tried to compile Linux kernel 2.6.19.2 with the
>new GNU C compiler version 4.3 snapshot 20070126.
>
>The compiler said
>
>fs/ufs/inode.c:817: warning: array subscript is above array bounds
>
>The source code is
>
> for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
> ufs_inode->ui_u2.ui_addr.ui_db[i] = ufsi->i_u1.i_data[i];
>
>but
>
>./include/linux/ufs_fs.h: __fs32 ui_db[UFS_NDADDR];/*
>0x28 data blocks */
>./include/linux/ufs_fs.h: __fs64
>ui_db[UFS_NDADDR]; /* 112: Direct disk blocks. */
>
>and
>
> __fs32 i_data[15];
>
>and
>
>#define UFS_NDADDR 12
>#define UFS_NINDIR 3
>
>so the kernel seems to be trying to write fifteen bytes into an array only
>twelve
>bytes in size. Suggest code rework.


As I see, linux-kernel is very high volume(noise?) list,
may better wil be resend to relevant mantainer(Andrew Morton?)

2007-01-31 21:24:41

by Andrew Morton

Subject: Re: fs/ufs/inode.c:817: warning: array subscript is above array bounds

On Wed, 31 Jan 2007 23:10:57 +0300
"Tomasz Kvarsin" <[email protected]> wrote:

> d binderman wrote:
> >Hello there,
> >
> >I just tried to compile Linux kernel 2.6.19.2 with the
> >new GNU C compiler version 4.3 snapshot 20070126.
> >
> >The compiler said
> >
> >fs/ufs/inode.c:817: warning: array subscript is above array bounds
> >
> >The source code is
> >
> > for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
> > ufs_inode->ui_u2.ui_addr.ui_db[i] = ufsi->i_u1.i_data[i];
> >
> >but
> >
> >./include/linux/ufs_fs.h: __fs32 ui_db[UFS_NDADDR];/*
> >0x28 data blocks */
> >./include/linux/ufs_fs.h: __fs64
> >ui_db[UFS_NDADDR]; /* 112: Direct disk blocks. */
> >
> >and
> >
> > __fs32 i_data[15];
> >
> >and
> >
> >#define UFS_NDADDR 12
> >#define UFS_NINDIR 3
> >
> >so the kernel seems to be trying to write fifteen bytes into an array only
> >twelve
> >bytes in size. Suggest code rework.
>
>
> As I see, linux-kernel is very high volume(noise?) list,
> may better wil be resend to relevant mantainer(Andrew Morton?)

Evgeniy, please consider raising a patch against ./MAINTAINERS ;)

2007-01-31 21:32:04

by Randy Dunlap

Subject: Re: fs/ufs/inode.c:817: warning: array subscript is above array bounds

On Wed, 31 Jan 2007 23:10:57 +0300 Tomasz Kvarsin wrote:

> d binderman wrote:
> >Hello there,
> >
> >I just tried to compile Linux kernel 2.6.19.2 with the
> >new GNU C compiler version 4.3 snapshot 20070126.
> >
> >The compiler said
> >
> >fs/ufs/inode.c:817: warning: array subscript is above array bounds
> >
> >The source code is
> >
> > for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
> > ufs_inode->ui_u2.ui_addr.ui_db[i] = ufsi->i_u1.i_data[i];
> >
> >but
> >
> >./include/linux/ufs_fs.h: __fs32 ui_db[UFS_NDADDR];/*
> >0x28 data blocks */
> >./include/linux/ufs_fs.h: __fs64
> >ui_db[UFS_NDADDR]; /* 112: Direct disk blocks. */
> >
> >and
> >
> > __fs32 i_data[15];
> >
> >and
> >
> >#define UFS_NDADDR 12
> >#define UFS_NINDIR 3
> >
> >so the kernel seems to be trying to write fifteen bytes into an array only
> >twelve
> >bytes in size. Suggest code rework.
>
>
> As I see, linux-kernel is very high volume(noise?) list,
> may better wil be resend to relevant mantainer(Andrew Morton?)

UFS doesn't have a known maintainer in the MAINTAINERS file.
The last big patcher of it is:
Evgeniy Dushistov <[email protected]>


---
~Randy

2007-02-01 20:49:48

by Evgeniy Dushistov

Subject: Re: fs/ufs/inode.c:817: warning: array subscript is above array bounds

On Wed, Jan 31, 2007 at 01:24:32PM -0800, Andrew Morton wrote:
> On Wed, 31 Jan 2007 23:10:57 +0300
> "Tomasz Kvarsin" <[email protected]> wrote:
>
> > d binderman wrote:
> > >Hello there,
> > >
> > >I just tried to compile Linux kernel 2.6.19.2 with the
> > >new GNU C compiler version 4.3 snapshot 20070126.
> > >
> > >The compiler said
> > >
> > >fs/ufs/inode.c:817: warning: array subscript is above array bounds
> > >
> > >The source code is
> > >
> > > for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
> > > ufs_inode->ui_u2.ui_addr.ui_db[i] = ufsi->i_u1.i_data[i];
> > >
> > >but
> > >
> > >./include/linux/ufs_fs.h: __fs32 ui_db[UFS_NDADDR];/*
> > >0x28 data blocks */
> > >./include/linux/ufs_fs.h: __fs64
> > >ui_db[UFS_NDADDR]; /* 112: Direct disk blocks. */
> > >
> > >and
> > >
> > > __fs32 i_data[15];
> > >
> > >and
> > >
> > >#define UFS_NDADDR 12
> > >#define UFS_NINDIR 3
> > >
> > >so the kernel seems to be trying to write fifteen bytes into an array only
> > >twelve
> > >bytes in size. Suggest code rework.

Actually, this is not a _real_ bug,
yes,
for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
ufs_inode->ui_u2.ui_addr.ui_db[i]

and ui_db only ui_db[UFS_NDADDR], but if look on more high level,
then:
union {
struct {
__fs64 ui_db[UFS_NDADDR]; /* 112: Direct disk blocks. */
__fs64 ui_ib[UFS_NINDIR];/* 208: Indirect disk blocks.*/
} ui_addr;
} ui_u2;

have no idea, why array splited on two parts,
may be some macros used this feature.

--
/Evgeniy