From: David Laight <David.Laight@ACULAB.COM>
To: "'Bjorn Helgaas'" <bhelgaas@google.com>,
        "David S. Miller" <davem@davemloft.net>
CC: Florian Fainelli <f.fainelli@gmail.com>,
        Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        James Morris <jmorris@namei.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>,
        Patrick McHardy <kaber@trash.net>
Subject: RE: [PATCH] tcp: fix compiler array bounds warning on
 selective_acks[]
Thread-Topic: [PATCH] tcp: fix compiler array bounds warning on
 selective_acks[]
Thread-Index: AQHPVQPliB8UXR9wYkmZkIsKPbQpM5sMG3zQ
Date: Fri, 11 Apr 2014 08:59:57 +0000
Message-ID: <063D6719AE5E284EB5DD2968C1650D6D0F6F5DFA@AcuExch.aculab.com>
References: <20140410213029.24916.93892.stgit@bhelgaas-glaptop.roam.corp.google.com>
In-Reply-To: <20140410213029.24916.93892.stgit@bhelgaas-glaptop.roam.corp.google.com>
Accept-Language: en-GB, en-US
Content-Language: en-US
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Sender: linux-kernel-owner@vger.kernel.org
Content-Transfer-Encoding: 8bit

Bjorn Helgaas 
> With -Werror=array-bounds, gcc v4.8.x warns that in tcp_sack_remove(), a
> selective_acks[] "array subscript is above array bounds".
> 
> I don't understand how gcc figures this out, or why we don't see similar
> problems many other places, but this is the only fix I can figure out.
...
> diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
> index 65cf90e063d5..65133b108236 100644
> --- a/net/ipv4/tcp_input.c
> +++ b/net/ipv4/tcp_input.c
> @@ -4047,7 +4047,8 @@ static void tcp_sack_remove(struct tcp_sock *tp)
> 
>  			/* Zap this SACK, by moving forward any other SACKS. */
>  			for (i = this_sack+1; i < num_sacks; i++)
> -				tp->selective_acks[i-1] = tp->selective_acks[i];
> +				if (i < ARRAY_SIZE(tp->selective_acks))
> +					tp->selective_acks[i-1] = tp->selective_acks[i];
>  			num_sacks--;
>  			continue;
>  		}

You really shouldn't add that test every time around the loop.

Try changing the loop so the assignment is:
   tp->selective_acks[i] = tp->selective_acks[i + 1];

or the loop test to:
	i <= num_sacks - 1;

Or beat up the gcc developers :-)

	David

????{.n?+???????+%?????ݶ??w??{.n?+????{??G?????{ay?ʇڙ?,j??f???h?????????z_??(?階?ݢj"???m??????G????????????&???~???iO???z??v?^?m????????????I?