[PATCH] tcp: fix compiler array bounds warning on selective_acks[]

[PATCH] tcp: fix compiler array bounds warning on selective_acks[]

[Bjorn Helgaas]

With -Werror=array-bounds, gcc v4.8.x warns that in tcp_sack_remove(), a
selective_acks[] "array subscript is above array bounds".

I don't understand how gcc figures this out, or why we don't see similar
problems many other places, but this is the only fix I can figure out.

Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
---
 net/ipv4/tcp_input.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 65cf90e063d5..65133b108236 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4047,7 +4047,8 @@ static void tcp_sack_remove(struct tcp_sock *tp)
 
 			/* Zap this SACK, by moving forward any other SACKS. */
 			for (i = this_sack+1; i < num_sacks; i++)
-				tp->selective_acks[i-1] = tp->selective_acks[i];
+				if (i < ARRAY_SIZE(tp->selective_acks))
+					tp->selective_acks[i-1] = tp->selective_acks[i];
 			num_sacks--;
 			continue;
 		}

RE: [PATCH] tcp: fix compiler array bounds warning on selective_acks[]

[David Laight]

Bjorn Helgaas 
> With -Werror=array-bounds, gcc v4.8.x warns that in tcp_sack_remove(), a
> selective_acks[] "array subscript is above array bounds".
> 
> I don't understand how gcc figures this out, or why we don't see similar
> problems many other places, but this is the only fix I can figure out.
...
> diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
> index 65cf90e063d5..65133b108236 100644
> --- a/net/ipv4/tcp_input.c
> +++ b/net/ipv4/tcp_input.c
> @@ -4047,7 +4047,8 @@ static void tcp_sack_remove(struct tcp_sock *tp)
> 
>  			/* Zap this SACK, by moving forward any other SACKS. */
>  			for (i = this_sack+1; i < num_sacks; i++)
> -				tp->selective_acks[i-1] = tp->selective_acks[i];
> +				if (i < ARRAY_SIZE(tp->selective_acks))
> +					tp->selective_acks[i-1] = tp->selective_acks[i];
>  			num_sacks--;
>  			continue;
>  		}

You really shouldn't add that test every time around the loop.

Try changing the loop so the assignment is:
   tp->selective_acks[i] = tp->selective_acks[i + 1];

or the loop test to:
	i <= num_sacks - 1;

Or beat up the gcc developers :-)

	David

Re: [PATCH] tcp: fix compiler array bounds warning on selective_acks[]

[Bjorn Helgaas]

On Fri, Apr 11, 2014 at 2:59 AM, David Laight <David.Laight@aculab.com> wrote:
> Bjorn Helgaas
>> With -Werror=array-bounds, gcc v4.8.x warns that in tcp_sack_remove(), a
>> selective_acks[] "array subscript is above array bounds".
>>
>> I don't understand how gcc figures this out, or why we don't see similar
>> problems many other places, but this is the only fix I can figure out.
> ...
>> diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
>> index 65cf90e063d5..65133b108236 100644
>> --- a/net/ipv4/tcp_input.c
>> +++ b/net/ipv4/tcp_input.c
>> @@ -4047,7 +4047,8 @@ static void tcp_sack_remove(struct tcp_sock *tp)
>>
>>                       /* Zap this SACK, by moving forward any other SACKS. */
>>                       for (i = this_sack+1; i < num_sacks; i++)
>> -                             tp->selective_acks[i-1] = tp->selective_acks[i];
>> +                             if (i < ARRAY_SIZE(tp->selective_acks))
>> +                                     tp->selective_acks[i-1] = tp->selective_acks[i];
>>                       num_sacks--;
>>                       continue;
>>               }
>
> You really shouldn't add that test every time around the loop.
>
> Try changing the loop so the assignment is:
>    tp->selective_acks[i] = tp->selective_acks[i + 1];
>
> or the loop test to:
>         i <= num_sacks - 1;
>
> Or beat up the gcc developers :-)

You're right, that *is* ugly.  And it seems that gcc-v4.9.x doesn't
complain about this, and that's good enough for my purposes, so I
withdraw this patch.

Thanks and sorry for the noise,
  Bjorn