From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752115AbdC0Tlw (ORCPT ); Mon, 27 Mar 2017 15:41:52 -0400 Received: from mail-pg0-f54.google.com ([74.125.83.54]:34721 "EHLO mail-pg0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751327AbdC0Tlp (ORCPT ); Mon, 27 Mar 2017 15:41:45 -0400 Date: Mon, 27 Mar 2017 12:32:42 -0700 From: Matthias Kaehlcke To: Johannes Berg Cc: "David S . Miller" , Felix Fietkau , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Grant Grundler Subject: Re: [PATCH] cfg80211: Fix array-bounds warning in fragment copy Message-ID: <20170327193242.GD84219@google.com> References: <20170325010644.190368-1-mka@chromium.org> <1490611679.3393.0.camel@sipsolutions.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1490611679.3393.0.camel@sipsolutions.net> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org El Mon, Mar 27, 2017 at 12:47:59PM +0200 Johannes Berg ha dit: > On Fri, 2017-03-24 at 18:06 -0700, Matthias Kaehlcke wrote: > > __ieee80211_amsdu_copy_frag intentionally initializes a pointer to > > array[-1] to increment it later to valid values. clang rightfully > > generates an array-bounds warning on the initialization statement. > > Work around this by initializing the pointer to array[0] and > > decrementing it later, which allows to leave the rest of the > > algorithm untouched. > > > > Signed-off-by: Matthias Kaehlcke > > --- > >  net/wireless/util.c | 3 ++- > >  1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/net/wireless/util.c b/net/wireless/util.c > > index 68e5f2ecee1a..d3d459e4a070 100644 > > --- a/net/wireless/util.c > > +++ b/net/wireless/util.c > > @@ -659,7 +659,7 @@ __ieee80211_amsdu_copy_frag(struct sk_buff *skb, > > struct sk_buff *frame, > >       int offset, int len) > >  { > >   struct skb_shared_info *sh = skb_shinfo(skb); > > - const skb_frag_t *frag = &sh->frags[-1]; > > + const skb_frag_t *frag = &sh->frags[0]; > >   struct page *frag_page; > >   void *frag_ptr; > >   int frag_len, frag_size; > > @@ -669,6 +669,7 @@ __ieee80211_amsdu_copy_frag(struct sk_buff *skb, > > struct sk_buff *frame, > >   frag_page = virt_to_head_page(skb->head); > >   frag_ptr = skb->data; > >   frag_size = head_size; > > + frag--; > > Isn't it just a question of time until the compiler will see through > this trick and warn about it? Maybe. Actually it seems the algorithm can be easily adapted to increment the pointer after consumption, which is clearer anyway. I will give this a shot. I'm not sure how to exercise the code path for testing and would appreciate help on this end. Matthias